New attack makes AI agents treat attacker data as trusted content

Researchers described Agent Data Injection, a new twist on prompt-injection attacks against AI agents. Rather than smuggling in fake instructions, it exploits the weak separation between trusted and untrusted data so that attacker-supplied content is mistaken for the agent's own trusted data, using deliberately ambiguous delimiters the model misreads. In tests against web and coding agents, this let an attacker steer an agent's clicks or actions, succeeding up to half the time even against defenses that block ordinary instruction injection. Some approaches helped: tagging page elements with random, unguessable identifiers roughly halved success, while strict tracking of where data came from stopped it but sharply reduced how many tasks agents completed.

Check

Review where AI agents in your environment consume untrusted content such as web pages, tickets, or logs, and check whether they clearly separate that data from trusted instructions and internal state.

Affected

Users and organizations running web or coding AI agents that act on external content; attackers can craft data the agent treats as trusted, steering its actions past defenses built for instruction injection.

Fix

Prefer agents that isolate and label untrusted data, use unguessable identifiers for page elements, track data provenance where feasible, keep a human in the loop for sensitive actions, and weigh usability costs.